Information Management Assessment

Action plan progress review

Foreign & Commonwealth Office

Reviewed September 2016

Published July 2017

Working with government to raise standards in information management Background The Information Management Assessment (IMA) programme is the best-practice model for government bodies wishing to demonstrate commitment to the principles of good information management.

The Foreign & Commonwealth Office (FCO) underwent an IMA in 2009 and a second IMA in 2014. This progress review summarises key developments since the IMA in 2014. Areas where continued attention is needed are listed below under ‘Next Steps.’

Action plan development The IMA report and summary action plan were published in March 2015 alongside a statement from then Permanent Secretary, Sir Simon Fraser.¹ This underlined the department’s commitment to improving the department's practice in a number of areas.

The statement noted that a detailed action plan was being developed and this provided the basis for our first progress meeting in November 2015. The production of the detailed IMA action plan was also referenced in the department’s annual report and accounts for 2014/15, demonstrating the significance attached to it.

In September 2016 The National Archives met with FCO to assess progress of the IMA action plan and this is a report based upon our assessment.

¹ http://www.nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/ Progress to address recommendations and risk areas

1 The value of information

| Performance rating | IMA 2014 | Review 2016 | |--------------------|----------------|-------------| | Communicating and realising value | Good practice | Good practice | | Managing information as an asset | Development area | Satisfactory |

Situation at the time of the IMA

FCO had refocussed its efforts to drive up information and records management capability. We gained a good level of assurance that it was recognised by the department as a vital area. A board-level champion had been appointed in 2012.

Strategic priorities had been established as a component of the FCO IT Vision 2015. Knowledge and Information Management (KIM) goals were effectively integrated with IT goals via the vision's Knowledge Excellence workstream.

We recommended that FCO continued to align its approaches under the Freedom of Information (FOI) Act and transparency agenda to enable closer and more formal collaboration between teams.

Information asset governance processes were not yet mature. FCO needed a more detailed understanding of the information assets it held to support the provision of assurance.

The first phase of Knowledge Excellence delivered a new intranet, knowledge and skills directory, an internal social media tool, a wiki and communities of practice. FCO is now rolling out Tech Overhaul, a programme to replace current IT systems, with the stated objective of transforming the way the department works. The Knowledge Excellence workstream has been integrated within the programme. FCO is using Tech Overhaul to redefine its information management processes and to focus on addressing digital records challenges and changing knowledge management behaviours. We gained written assurance that the progress of Tech Overhaul is subject to regular scrutiny from the Departmental Board, Operations Committee and Audit and Risk Committee.

FCO has worked to establish the role of KIM champion as part of the remit of the Chief Operating Officer (COO). To date this has provided the Knowledge Management Department (KMD) with a significant lever to help encourage improvements in information management culture. FCO now needs to ensure the role is fully embedded.

Executive Committee endorsement was obtained to establish a more joined-up approach to FOI and transparency. FCO has recognised the need to factor transparency requirements into its new IT system. The Transparency Unit joined KMD in September 2016. Volumes of FOI responses answered within the 21-day deadline or permitted extensions have remained above the 85% minimum requirement set by the Information Commissioner’s Office. At the time of writing, FCO had published the second highest amount of answers to FOI queries and third highest amount of transparency data on GOV.UK. It is one of a number of departments working with Government Digital Service and has received particular recognition for its country list.2

FCO has not yet engaged with Information Asset Owner (IAO) training provided by The National Archives. However, in 2016 FCO conducted a project to review and update the departmental Information Asset Register, focusing on enhancing the governance, security and management of information assets. This has enabled FCO to adopt a more proportionate, information and data-focused approach than was in place at the time of the IMA. A range of internal and external stakeholders were consulted in the course of the project, which placed a particular emphasis on datasets that contained personal data. We understand that all personal data was assessed against the recommended Cabinet Office security criteria issued at the time; Cabinet Office identified FCO as the ‘Most improved’ department and has stated that it is content with steps taken by FCO to develop its overall data management.

The new Information Asset Register includes a section on information and data management in addition to sections on system security and governance. This covers format and size of information assets as well as retention requirements. The register also has a section to support Knowledge and Technology Directorate (KTD) management that includes risks and digital continuity issues. FCO has designated a member of staff to maintain the register and intends to extend its approach to include datasets that do not contain personal data. FCO plans to conduct an annual review of all existing datasets included on the Information Asset Register, allowing it to amend entries as required.

2 Digital information and supporting technology

| Performance rating | IMA 2014 | Review 2016 | |------------------------------------|-------------------|----------------------| | Supporting information through technology | Development area | Progressing to satisfactory | | Digital continuity and IT change | Development area | Satisfactory |

Situation at the time of the IMA

The existing technology environment did not support the lifecycle management of digital information. Information was distributed between the department’s ERMS, iRecords, and a number of other locations including unstructured shared drives and SharePoint 2007 Team sites. The process of records creation was seen by staff as time-consuming. Many were using shared drives and email as the default storage location.

2 https://www.gov.uk/government/publications/registers/registers The IT Vision 2015 sought to improve the situation through the introduction of SharePoint 2013 and improving IT provision and access in the UK and overseas. FCO also needed to plan to ensure the completeness, availability and usability of its digital information over the long term.

While the IT environment still raises some of the same risks that were identified at the time of the IMA, FCO has taken a number of key steps to mitigate them including conducting an audit of SharePoint 2007 Team sites. From a cultural standpoint, FCO has sought to drive engagement and promote tools and approaches that clarify expectations and make it easier for staff to work effectively. Key approaches include Get Smart principles for the shared drives, the Detox your Inbox campaign and the email superhero challenge.

In addition, FCO has sought through the #EasyFile initiative to address the risk that staff are not registering records. This is intended as an interim filing solution that will reduce the burden on staff. It was endorsed at Executive Committee level and launched with a positional news item from the COO and KIM champion. This provided a clear senior steer on the importance of information and records management, noting obligations under the Public Records Act and Civil Service Code, stating:

We should all be concerned about our responsibility to retain documentation relating to key policy decisions. We’re not doing enough at the moment. One result is that we increase overstretch by wasting days trying to find information that should be readily available and risk reinventing the wheel every time we try to answer a question.

At the time of review, #EasyFile was due to be rolled out to overseas staff and FCO had noted a significant increase in the quantity of records registered.

FCO is now moving to implement Office 365 including SharePoint Online. Legislative and business requirements for managing digital information and records were defined with input from Subject Matter Experts and a high-level information policy captures key principles for the design and use of the system.

FCO has taken a number of active steps to mitigate digital continuity risk; it highlighted digital continuity planning as a key driver for work to overhaul the Information Asset Register. FCO has sought to gain oversight and understanding of its key repositories in advance of Tech Overhaul and has appointed a member of staff to implement a strategy for redundant obsolete and trivial material held across its network. Considerable effort has been invested in migration planning. A data migration project has defined process maps for migration from shared and personal drives, SharePoint 2007 sites and email accounts. The Departmental Records Officer (DRO) is joint lead for this work. A policy has been defined to provide a solution for the 20,000 .pst files that have been identified, setting out a roadmap for review, capture and, where appropriate, deletion ahead of migration. This includes provision for supporting staff where needed and for central ownership of any orphaned .pst files. A high-level corporate data platform design strategy has been created to ensure FCO’s information management and collaboration needs are met. FCO has an existing thesaurus and metadata framework and has placed a clear emphasis on search functionality within the new IT environment, with a commitment made to dedicate resource to ensuring this is as good as it can be.

3 Information risk, governance and oversight

| Performance rating | IMA 2014 | Review 2016 | |-----------------------------|----------------|-------------| | Recognising information risk| Development area | Development area | | Establishing control | Satisfactory | Satisfactory | | Providing guidance | Satisfactory | Satisfactory | | Measuring impact | Good practice | Satisfactory |

Situation at the time of the IMA

FCO was working to improve its performance in information management, but we saw no evidence that risks related to capturing, keeping and making information available had been formally defined. The KMD risk register had recently been overhauled but did not refer to FCO’s obligations for safekeeping of records, including ensuring the ongoing usability of digital information.

A Knowledge Excellence Committee had been established, which was chaired by the Senior Information Risk Owner and Chief Information Officer. In our first IMA of FCO we recommended that more use could be made of the Information Management Officer (IMO) role, but the network was not yet working effectively.

Information and records management policy was up to date, but we gained limited assurance that adequate controls were in place in relation to staff-led disposal of information from locations outside the ERMS, including the shared drives.

An FCO information management maturity model had been established and a rolling programme of health checks was in operation, covering UK-based and overseas staff. Reports made recommendations for improvement and directors and heads of post were identified as key recipients.

FCO has not produced an information risk policy – which remains a mandatory requirement under the Security Policy Framework – or updated its information security policy to include a statement on information and records management risk.³

FCO’s corporate risk policy requires risks beneath the level of the main corporate risk register to be captured on directorate business plans. FCO states that key information and records management related risks are captured in the Tech

³ [https://www.gov.uk/government/collections/government-security](https://www.gov.uk/government/collections/government-security) Overhaul business case and its migration strategy. We note that regular presentations are made to the Audit and Risk Committee on information risk and cyber security and to the Operations Committee on topics including compliance with The Public Records Act and performance against Freedom of Information deadlines.

While this is positive, information and records management risks captured in the KTD business plan we reviewed did not clearly set out the role of information management practice and current technology provision or the potential business impact of poor performance. The risk of a failure to ensure the long-term usability of digital information was also not clearly set out, including the potential impact on the department’s ability to meet its responsibilities in the future under the Public Records Act. As a consequence, and in the absence of an information risk policy, FCO is not yet consistently communicating the full potential impact of information and records management related risk in formal terms.

Following the IMA, FCO conducted a review of the IMO role covering arrangements in the UK and overseas. This highlighted a range of gaps and inconsistencies and made a series of recommendations covering definition of function, training provision and role allocation.

The overarching FCO information and records management policy has not been reviewed and the main policy statement on the purpose of the shared drives has not been adjusted since the IMA. As a result, FCO still lacks a fully clear high-level statement on the purpose of the shared drives, the type of information that can be stored there and the way it must be managed. However, supporting guidance including What to Keep is now reviewed annually. The department’s disposal or retention of documents policy was published on GOV.UK in November 2015. This was done in response to an FOI enquiry about ministerial diaries and is in line with recommendations made in Sir Alex Allan’s 2014 Records Review report. FCO states that the new KIM intranet page was launched in August 2016 and that content is now presented more clearly.

FCO sought advice on retention and disposal of content on its previous intranet, FCONet, in advance of the introduction of its replacement during the first phase of Knowledge Excellence. A retention and disposal policy was implemented and staff and historians were engaged to ensure information with potential historical value was identified and captured through the #EasyFile initiative.

KMD has suspended its good-practice health check programme to allow it to prioritise migration to Office 365, and therefore lacks the mechanism it had at the time of the IMA to proactively identify and target areas of poor practice within business areas. We recognise, however, that it is using the #EasyFile process to target on a department-wide rather than team basis the specific issue of records capture, which it has prioritised ahead of the move to its new IT environment. We also recognise that FCO is tracking take-up of the process through published league tables. While these do not provide any qualitative insight, they have provided a view on which business areas are engaging in the process as well as encouraging an

______________________________________________________________________

4https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/470326/FCO_retention_schedule.pdf element of competition. Additionally, all directors and heads of posts remain accountable through the Annual Consolidated Certificate of Assurance (ACCA) for their teams’ adherence to mandated information and records management procedures. This has been incorporated as an active policy choice. As part of this, directors and heads of posts are now asked to confirm that at least one IMO has been appointed and that all relevant documents are registered on iRecords, either directly or through #EasyFile.

4 Records, review and transfer

| Performance rating | IMA 2014 | Review 2016 | |-------------------------------------|----------|-------------| | Oversight of records and selection | Satisfactory | Satisfactory | | Implementing disposal decisions | Satisfactory | Satisfactory |

**Situation at the time of the IMA**

The DRO role was held by the head of knowledge, who had a direct reporting line to the SIRO and CIO and as such the DRO was well placed to exert influence. Despite this the role had low recognition among staff. FCO was engaged with The National Archives’ digital transfer project and had begun work on an appraisal report in the immediate aftermath of the IMA.

FCO was working with The National Archives to increase its understanding of wider sensitivities beyond those relating to diplomatic relations. It was behind in relation to the timetable for transition to the 20-year rule, but was committed to getting back on track.

FCO is now producing a draft appraisal report with input from The National Archives. Guidance on where to turn for advice on records is published on FCO’s intranet; guidance covering handling records as a component of Machinery of Governance changes emphasises the role of the DRO and central team.

FCO continues to face a significant challenge in terms of the volume of records it holds. The 2014 department-wide audit of paper holdings has given FCO a clearer understanding of its paper records and the scale of challenge it faces in terms of their appraisal, selection and transfer. More than 1 million hard copy equivalent files are now held at the department’s records store. As a legacy of the current IT environment, and despite the benefits delivered by #EasyFile, FCO lacks practical oversight of records stored in shared drives and control over their disposal and destruction. FCO plans to address this situation through Tech Overhaul and the creation of a legacy on-premise data store.

FCO has continued to engage with the Advisory Council over any gaps in meeting projected targets to ensure required legal cover is in place. It is a participant in The National Archives’ accelerated transfer programme, through which it transferred 21,404 records in 2016, the second highest volume of any transferring organisation. In line with the requirements of the 20-Year Rule, FCO’s first digital transfer is scheduled for 2019 alongside the paper records for that year. Key challenges include the varied security classifications of records and the need to bring them together in the same environment, together with duplication and metadata quality. FCO is working on a digital transfer pilot in 2017/18.

Next Steps The National Archives will continue to work closely with FCO so that the department is supported as it continues its work on information and records management through to the time of its next IMA in 2019/20. In the interim, we recommend that the following points are focussed on and built into departmental business planning:

- Ensure continuity of the KIM champion role through changes in senior personnel.
- Defining how good practice in the management, protection and exploitation of information will be achieved and maintained beyond completion of Tech Overhaul. Setting a clear strategic vision and defining joined-up strategic goals will ensure FCO can continue to strengthen knowledge and information management culture and obtain full benefit from its new IT environment.
- Continuing to liaise with The National Archives on the adoption of Office 365 and SharePoint Online, implementation of its data migration strategy and digital continuity planning.
- Reviewing policy statements on shared drive usage to ensure clear expectations are set for managers and staff ahead of migration and through to the end of Tech Overhaul. Once IT related barriers to information capture have been removed, a clear mandate for information and records management in the Office 365 environment should be established, with particular attention given to areas such as email capture and OneDrive use.
- Defining and logging on the KTD risk register the risks raised by the current IT environment and information management culture and the risk of a failure to maintain the usability of digital information.
- Producing an information risk policy in line with Security Policy Framework mandatory requirements that covers information and records management related risk and how it needs to be managed.
  - To enable consistent formal communication of risk over the long-term, including to the business, FCO should review wording of risks logged in the KTD business plan. It should consider how cultural and IT related factors can be bought out together with risks related to digital continuity.
- Defining how information and records management performance will be monitored in the new IT environment. The Section 46 Code of Practice recommends that this should be established in information and records management policy.(^5)
- Finalising and signing off the appraisal report and using it to inform appraisal and selection of records.
- Continuing to work with The National Archives on the transfer of digital information.

(^5) [http://www.nationalarchives.gov.uk/documents/foi-section-46-code-of-practice.pdf](http://www.nationalarchives.gov.uk/documents/foi-section-46-code-of-practice.pdf)